Repository navigation
netutils/dhcpd: prevent out-of-bounds DHCP option read - #3897
Merged
Merged
Conversation
dhcpd_parseoptions() read the option length byte for every non-PAD/non-END option without first checking that two bytes remained in the current options field. A malformed packet ending with a single non-PAD option byte could therefore read one byte past the end of the options array. Check that the option header is present before reading the length byte, and reject options whose declared length extends beyond the current field. Also allow options that exactly consume the remaining field bytes, and avoid using a stale option length when switching to overloaded file/sname option fields. This prevents malformed DHCP client requests from causing out-of-bounds reads during DHCP server option parsing.
xiaoxiang781216
approved these changes
Oct 22, 2026
acassis
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix an out-of-bounds read in the DHCP server option parser.
dhcpd_parseoptions()parsed each non-PAD/non-END DHCP option by reading theoption length byte before verifying that at least two bytes remained in the
current options field. A malformed packet ending with a single non-PAD option
byte could therefore read one byte past the end of the current DHCP options
field.
Fix
This patch hardens DHCP option parsing by:
before reading the length byte;
file/snameoption fields.Impact
This prevents malformed DHCP client requests from causing out-of-bounds reads
during DHCP server option parsing.
Testing
sim/usbdev